Falhas do tipo CWE-80

646 resultados

Falta de neutralização de tags HTML relacionadas a scripts (XSS básico)

Ocorre quando a aplicação web recebe entrada do usuário e a exibe no HTML sem sanitizar tags de script e eventos (como <script>, onclick, onerror). Um atacante injeta código JavaScript malicioso que executa no navegador da vítima, roubando cookies, sessões ou dados sensíveis.

Exemplo

Um formulário de comentários aceita '<img src=x onerror="alert(document.cookie)">'. A aplicação exibe o comentário sem filtro na página, e o navegador executa o código malicioso quando carrega a imagem inválida, capturando a sessão do usuário.

Como mitigar

Escape ou remova todas as tags HTML perigosas antes de renderizar (use bibliotecas como DOMPurify ou sanitizadores nativos da stack). Aplique Content Security Policy (CSP) nos headers HTTP para bloquear inline scripts mesmo que a injeção passe.

CVE-2024-58353CRITICALCal.com through 4.7.15 Cross-Site Scripting via booking questionsEPSS 0.4%CVE-2024-6183MEDIUMEZ-Suite EZ-Partner Forgot Password cross site scriptingEPSS 0.4%CVE-2025-51989HIGHHTML injection vulnerability in the registration interface in Evolution Consulting Kft. HRmaster module v235 allows an attacker to inject HTEPSS 0.4%CVE-2026-32773MEDIUMApache Spark: XSS Vulnerability in Spark Web 3.5.4EPSS 0.4%CVE-2024-24874MEDIUMWordPress Polls CP plugin <= 1.0.71 - Content Injection vulnerabilityEPSS 0.4%CVE-2024-47812MEDIUMCross-site Scripting (XSS) on Special:RequestImportQueue when displaying request date in ImportDumpEPSS 0.4%CVE-2023-50933MEDIUMIBM PowerSC HTML injectionEPSS 0.4%CVE-2025-53835CRITICALXWiki Rendering is vulnerable to XSS attacks through insecure XHTML syntaxEPSS 0.4%CVE-2025-36321MEDIUMVulnerabilities found in Watson Data IntelligenceEPSS 0.4%CVE-2023-23548MEDIUMXSS in business intelligenceEPSS 0.4%CVE-2024-20382MEDIUMA vulnerability in the VPN web client services feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat DefensEPSS 0.4%CVE-2023-22309MEDIUMReflected Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-1154MEDIUMSourceCodester E-Learning System Lesson index.php cross site scriptingEPSS 0.4%CVE-2023-45635MEDIUMWordPress Responsive Tabs plugin < 4.0.6 - HTML Content Injection vulnerabilityEPSS 0.4%CVE-2026-54503MEDIUMplone.app.textfield: Stored XSS by spoofing mime typeEPSS 0.4%CVE-2026-82838MEDIUMDefault webserver configuration with incorrect CSPEPSS 0.4%CVE-2024-27716MEDIUMCross Site Scripting vulnerability in Eskooly Web Product v.3.0 and before allows a remote attacker to execute arbitrary code via the messagEPSS 0.4%CVE-2026-57535LOWContent injected to PDF rendering contexts could, in many places, include HTML content including <img> tags. If the src attribute of these EPSS 0.4%CVE-2024-52597MEDIUM2FAuth vulnerable to stored cross-site scripting via SVG upload and direct access renderEPSS 0.4%CVE-2023-28851MEDIUMSilverstripe Form Capture vulnerable to Stored Cross-Site ScriptingEPSS 0.4%